Skip to main content
This short demo walks through common firewalld tasks on Red Hat Enterprise Linux (RHEL). You’ll verify the daemon is running, inspect active zones and interfaces, list zone settings, and modify the firewall at runtime and persistently. By the end you should be comfortable inspecting and changing firewall rules using firewall-cmd.

​
Verify firewalld is running

Start by checking the systemd service and the firewalld runtime state:
If firewall-cmd --state returns running, the daemon is active and ready to accept commands.

​
Active zones and interfaces

List active zones to see which network interface(s) are bound to which zone:
Zones map network interfaces and sources to a predefined set of rules (services, ports, targets). Knowing which zone applies to an interface is key to applying the correct policy.

​
Show full zone configuration

To inspect all settings for the current (active or default) zone, use --list-all:
To view every zone (including inactive ones) and their settings, use:
This output is useful for auditing which services and ports are allowed across all zones.

​
Adding and persisting services

Allow an existing service (for example, HTTP) at runtime only:
Make the same change persistent (written into firewalld configuration):
Important: adding with --permanent updates configuration files but does not change the current runtime rules. Either add the non-permanent rule (without --permanent) to apply immediately, or reload persistent configuration into runtime:
List currently enabled services (runtime):
Using --permanent writes the rule to the configuration. To apply those persistent rules to the running firewall, run firewall-cmd --reload.

​
Adding and persisting ports

Open a custom port (for example TCP 9294) at runtime:
Make the port permanent:
Then reload to apply permanent changes to the running daemon:

​
Adding sources to zones and blocking traffic

You can bind a specific IP source to a zone. For example, add a source to the default zone (runtime):
Or add a source directly to the block zone (runtime):
Assigning a source to the block zone rejects or drops packets according to that zone’s target. Verify zones and their sources:
When assigning sources to restrictive zones (for example block), confirm the IPs are correct. Mistakenly blocking legitimate clients can cause loss of access.
If you used --permanent when adding a source, remember to --reload to apply it to the running firewall.

​
Removing rules

To remove a rule, replace --add-* with --remove-*. Examples:
  • Remove an enabled service at runtime:
  • Remove a persistent service and reload:
This same pattern applies to ports, sources, and other rule types.

​
Rich rules

Firewalld rich rules provide advanced, expressive controls (logging, matching by source/protocol, forwarding, rate limiting, etc.). They are not required for the RHCSA exam but are extremely useful in production environments where you need fine-grained behavior. See firewalld rich rule examples in the official documentation for patterns and syntax.

​
Quick reference — common firewall-cmd tasks

​
Summary

This demo covered essential firewalld tasks on RHEL:
  • Verifying firewalld status and runtime state
  • Viewing active zones and their interfaces
  • Inspecting zone configuration with --list-all and --list-all-zones
  • Allowing services and ports at runtime and persisting them with --permanent
  • Assigning sources to zones (including the block zone) and understanding targets
  • Removing rules and using --reload to apply persistent changes
  • A brief note about advanced rich rules
For exam preparation see the RHCSA certification details: RHCSA exam information.
A dark-themed slide titled "Summary" with a vertical list of networking topics on the right, including items like "Networking concepts," "Checking network configuration," "Working with nmcli," and "Configuring Firewalld."
Together, these skills will help you configure networking and troubleshoot connectivity issues on Red Hat Enterprise Linux systems.

Watch Video

Practice Lab